Microsoft Certification
61 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Configuring and Operating Microsoft Azure Virtual Desktop (AZ-140) certification validates professional expertise in Microsoft technologies. This study guide covers all 61 practice questions from our AZ-140 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You need to configure Azure Virtual Desktop to use Azure AD Join for session hosts. Which requirement must be met before implementing Azure AD Join?
Azure AD Join for AVD session hosts requires Windows 10 or Windows 11 Enterprise multi-session operating systems. While Azure AD connectivity is needed, the OS version is the primary prerequisite.
When implementing Azure Virtual Desktop, you configure conditional access policies. What happens when a user's device fails to meet the conditional access requirements during sign-in?
Conditional access policies enforce device and user requirements at sign-in time. Failure to meet policy conditions results in access denial or requirement for additional verification such as MFA.
You are configuring FSLogix profile containers for Azure Virtual Desktop. Which storage solution is recommended for optimal performance in a multi-user environment?
Azure Files premium SMB shares are optimized for FSLogix deployments, providing the necessary IOPS and throughput for multiple concurrent user profile loads in enterprise environments.
During Azure Virtual Desktop deployment, you need to ensure session hosts can authenticate against your on-premises Active Directory. Which hybrid identity approach would you implement?
Azure AD Connect synchronizes on-premises Active Directory identities to Azure AD, enabling users to authenticate using their domain credentials in Azure Virtual Desktop environments.
You are implementing Azure Virtual Desktop with pooled host pools. Users report inconsistent application availability across sessions. What is the most likely cause?
In pooled host pools, inconsistent application availability typically results from non-standardized application deployment across session hosts. All hosts in a pooled environment should have identical application configurations.
What is the primary advantage of using a personal host pool instead of a pooled host pool in Azure Virtual Desktop?
Personal host pools assign dedicated session hosts to individual users, maintaining persistent application and system state between sessions, which is beneficial for specialized workloads requiring customization.
You configure diagnostics for Azure Virtual Desktop to troubleshoot connection issues. Which diagnostic data helps identify authentication failures during user sign-in?
AVD Diagnostics in Log Analytics provides detailed connection logs including authentication events, allowing administrators to trace sign-in failures and session establishment issues.
When deploying Azure Virtual Desktop in a highly regulated industry, you must ensure all user sessions are encrypted. Which encryption method is applied by default to AVD connections?
Azure Virtual Desktop uses SSL/TLS encryption by default to secure RDP protocol communications between clients and session hosts, protecting transmitted data from interception.
You implement autoscale for your Azure Virtual Desktop host pool to manage costs. During off-peak hours, a session host is deallocated. Which impact occurs to active user sessions on that host?
Azure Virtual Desktop autoscale respects active user sessions and will not deallocate a host that has connected users. The host remains active until sessions naturally disconnect.
What is the correct procedure for updating session host images in a running Azure Virtual Desktop host pool to minimize user disruption?
The recommended approach involves creating a new image with updates, updating the host pool configuration, then using drain mode to prevent new sessions on old hosts before removal.
You configure the Azure Virtual Desktop environment to use RemoteApp applications instead of full desktop sessions. What operational benefit does this provide?
RemoteApp delivers individual applications to users rather than full desktop sessions, reducing resource consumption, bandwidth usage, and providing a more focused application experience.
During Azure Virtual Desktop deployment, you discover that users cannot access network printers shared on your on-premises network. Which configuration is required to enable printer access?
Printer access requires RDP device redirection configuration and network connectivity to on-premises print servers. This can be achieved through VPN, ExpressRoute, or Azure bastion connectivity.
You need to implement multi-factor authentication (MFA) for Azure Virtual Desktop users. At what point in the authentication process is MFA enforced?
MFA for Azure Virtual Desktop is enforced at the Azure AD authentication stage before RDP protocol negotiation, using Azure AD Conditional Access policies.
When configuring user assignments for Azure Virtual Desktop application groups, what is the difference between direct assignment and group assignment?
Direct assignment targets specific user accounts, while group assignment uses AD groups, enabling scalable and manageable access control as user populations grow.
You are troubleshooting Azure Virtual Desktop client connectivity issues. Users report that connections drop after 15 minutes of inactivity. Which setting should you review?
Idle session disconnection is controlled by Group Policy settings or host pool configurations that define timeout thresholds for inactive RDP sessions.
What is the recommended method for deploying Azure Virtual Desktop in a disaster recovery scenario requiring high availability across multiple regions?
Multi-region AVD deployments use Azure Traffic Manager to distribute clients across identical host pools in different regions, providing geographic redundancy and disaster recovery capabilities.
You configure Azure Virtual Desktop to use the RDP Shortpath transport protocol. Which network requirement must be satisfied for Shortpath to function?
RDP Shortpath requires a direct UDP connection (typically port 3390) between client and session host, bypassing the Azure gateway for lower latency and reduced bandwidth consumption.
When implementing Azure Virtual Desktop with Start VM on Connect functionality, what prerequisite must be met?
Start VM on Connect requires the Azure Virtual Desktop service to have appropriate managed identity permissions to start deallocated VMs when users connect.
You are configuring user profiles in Azure Virtual Desktop and need to choose between FSLogix, Citrix Profile Manager, and OneDrive for Business. Which combination provides the best profile roaming with Windows Search indexing?
FSLogix provides efficient profile management while OneDrive integrates with Windows Search for indexing, creating a comprehensive solution for profile roaming and search functionality.
During Azure Virtual Desktop operations, you observe that certain RemoteApp applications are not appearing for specific users despite correct application group assignments. What should you verify first?
RemoteApp availability depends on application installation on session hosts and appropriate file system permissions. Users cannot access applications that are not installed or for which they lack execution rights.
What is the primary security advantage of using Azure Bastion instead of exposing RDP ports directly to the internet for Azure Virtual Desktop session host management?
Azure Bastion provides secure administrative access to session hosts without exposing RDP ports to the internet, eliminating public IP requirements and enabling centralized access logging and control.
You need to implement Azure Virtual Desktop for a scenario requiring persistent desktop customization and application state preservation across sessions. Which host pool type is most appropriate?
Personal host pools assign dedicated session hosts to individual users, preserving all desktop customizations, application installations, and system state between sessions.
When configuring Azure Virtual Desktop compliance requirements, you must ensure that session host operating system patches are applied within 30 days of release. Which approach best automates this requirement?
Azure Update Management provides scheduled patch deployment with deadline enforcement, compliance reporting, and automation across multiple session hosts, meeting regulatory requirements effectively.
You are implementing Azure Virtual Desktop in an environment with strict data residency requirements. Which configuration ensures that user data remains within a specific geographic region?
Comprehensive data residency compliance requires deploying resources in the target region, enforcing regional policies, using LRS storage, and disabling cross-region replication features.
During Azure Virtual Desktop troubleshooting, you find that users experience degraded performance when multiple users access resource-intensive applications simultaneously on the same session host. What is the most effective remediation?
Performance issues stem from insufficient resources. Proper capacity planning involves monitoring resource utilization and either increasing host VM specifications or expanding the host pool.
What is the correct process for implementing zero-trust security principles in an Azure Virtual Desktop environment?
Zero-trust in AVD requires multiple security layers: conditional access enforcement, MFA requirements, device compliance validation, encryption, and least-privilege permissions rather than trust-based models.
You need to migrate existing Remote Desktop Services (RDS) deployments to Azure Virtual Desktop. Which component from RDS does NOT have a direct equivalent in Azure Virtual Desktop?
Azure Virtual Desktop uses subscription-based licensing rather than RDS CALs. The traditional RDS License Server with per-device licensing model has no direct equivalent in AVD.
You need to deploy Azure Virtual Desktop in a new Azure subscription. Which resource must be created first to support AVD infrastructure?
An Azure Virtual Network is a foundational prerequisite for deploying AVD resources, as all VMs and services require network connectivity. Host Pools, Application Groups, and Workspaces are created after networking is established.
You are configuring a pooled host pool with 10 session hosts for a call center environment. Users report connection failures during peak hours. What is the most likely cause?
In a pooled host pool, connection failures during peak hours typically indicate that session hosts have reached their maximum session capacity. This is a configuration and load-balancing issue rather than infrastructure problems.
Your organization requires persistent user desktop environments where each user receives the same desktop upon login. Which host pool type should you implement?
Personal host pools with automatic assignment ensure persistent environments where each user is assigned to a specific session host and receives the same desktop experience. Pooled configurations are for shared environments, while direct assignment requires manual user-to-host mapping.
You need to implement FSLogix profile containers for 500 users across multiple session hosts. Which Azure Storage account configuration provides optimal performance?
Premium Azure Files with SMB 3.1.1 protocol and Active Directory authentication is the recommended configuration for FSLogix profile containers, providing optimal performance, encryption in transit, and secure identity-based authentication.
A user's FSLogix profile container is locked and preventing login. What is the appropriate troubleshooting step?
When a profile container is locked, the issue is typically caused by an orphaned session or storage connectivity problem. Checking for active sessions and verifying storage connectivity will identify the root cause without destructive actions.
You are deploying AVD with Microsoft Entra ID (Azure AD) joined session hosts instead of Active Directory domain-joined. What limitation must you consider?
Microsoft Entra ID-joined session hosts have limitations with FSLogix profile containers in standard configurations. Hybrid join or additional configuration through cloud identity solutions may be required for profile management.
Your organization's AVD deployment experiences high latency for users in remote branch offices. What is the most effective optimization?
Geographic proximity between users and session hosts is the primary factor affecting latency in AVD. Deploying session hosts in a closer region or using Azure regional proximity provides the most effective latency reduction.
You need to configure Azure Virtual Desktop to support graphics-intensive CAD applications. Which session host VM type is most appropriate?
NV-series VMs provide GPU acceleration necessary for graphics-intensive applications like CAD. These VMs include NVIDIA GPUs and require appropriate graphics drivers for optimal performance.
You are configuring Application Groups for your AVD deployment. A user should only access specific RemoteApp applications, not the full desktop. Which Application Group type should you create?
RemoteApp Application Groups allow you to publish individual applications rather than full desktop access. This provides granular control over which applications users can access.
Your AVD environment requires SSO (Single Sign-On) for users accessing both AVD and Microsoft 365 applications. Which authentication method should be implemented?
Microsoft Entra ID with seamless SSO or Hybrid Identity configuration enables users to authenticate once and access both AVD and Microsoft 365 resources without re-authentication.
You need to implement a disaster recovery solution for your AVD environment. Session hosts must be able to failover automatically to a secondary Azure region. What is required?
Azure Site Recovery provides the infrastructure for replicating session host VMs to a secondary region and managing automated failover when disasters occur, ensuring business continuity for AVD deployments.
You observe that some users experience printer redirection failures in their AVD sessions. What is the first diagnostic step?
Printer redirection issues are commonly caused by improper Universal Print configuration or insufficient printer sharing permissions. Verifying connector status and printer assignment is the appropriate first diagnostic step.
Your organization has a requirement to audit all user actions within AVD sessions for compliance purposes. Which feature should you implement?
AVD Diagnostics integrated with Log Analytics and Windows Event Log collection provides comprehensive audit trails of user actions. This combination enables compliance requirements for detailed session activity tracking.
You are configuring role-based access control (RBAC) for your AVD infrastructure. Which role allows a user to manage host pools but not create new Azure resources?
Desktop Virtualization Contributor role grants permissions to manage AVD resources including host pools and application groups, without granting broad Azure resource creation permissions.
Your AVD environment requires users to connect from unmanaged devices. What security measures should be implemented? (Choose the scenario that best addresses this)
Conditional Access policies with MFA and device compliance checks provide robust security for unmanaged device connections by enforcing authentication and compliance requirements before allowing AVD access.
You need to distribute Windows updates to 50 session hosts in a pooled host pool without disrupting user sessions. What approach is recommended?
Azure Update Management allows scheduling updates during maintenance windows while host draining ensures no new sessions are assigned, allowing existing sessions to complete before updates are applied.
Your organization is migrating from a legacy VDI solution to Azure Virtual Desktop. You need to transfer 200 user profiles. What is the most efficient method?
FSLogix provides migration tools and third-party utilities enable efficient migration of multiple user profiles to FSLogix profile containers, maintaining profile integrity and reducing downtime.
You are configuring bandwidth optimization for AVD users on low-speed WAN connections. Which setting provides the most effective optimization?
Graphics compression and optimized video codec settings in RDP properties are the recommended bandwidth optimizations for low-speed connections, balancing visual quality with network efficiency.
A user cannot connect to their AVD session after a session host Windows Update. What is the most likely cause and appropriate fix?
Windows updates can occasionally affect network configuration. Checking the session host's network interface status and verifying network settings should resolve post-update connectivity issues.
You need to implement auto-scaling for your pooled host pool to handle variable user demand. What is the prerequisite configuration?
AVD scaling plans enable automatic adjustment of session host capacity based on schedules or performance metrics. This prerequisite configuration allows the system to add or remove hosts based on demand automatically.
Your organization requires split-tunnel VPN configuration for AVD connections to improve performance. What consideration is most critical?
While split tunneling can improve AVD performance by routing AVD traffic directly, security policies must explicitly permit this configuration and sensitive data must still traverse the VPN tunnel securely.
You are troubleshooting why users cannot see RemoteApp applications published to their Application Group. What is the most common cause?
RemoteApp visibility depends on proper assignment chain: users must be assigned to the Application Group, and the Application Group must be assigned to a Workspace for users to see the applications.
Your AVD environment experiences performance degradation during high-concurrent-session periods. Which metric should you monitor to identify resource bottlenecks?
Comprehensive performance analysis requires monitoring multiple metrics including CPU, memory, disk I/O, and network utilization along with user experience metrics to identify true bottlenecks in AVD environments.
You need to ensure that AVD users can access on-premises resources securely. Which network connectivity option provides the best performance?
Azure ExpressRoute or Site-to-Site VPN provides secure, dedicated connectivity between AVD session hosts and on-premises resources, offering superior performance and reliability compared to internet-based access.
You need to configure RemoteApp publishing in Azure Virtual Desktop. Which component is responsible for managing the RemoteApp application groups and their assignments?
Application groups are the Azure Virtual Desktop objects that contain collections of RemoteApps or desktops and control which users can access them. They are essential for publishing and managing RemoteApp resources.
What is the primary purpose of configuring Azure Virtual Desktop Diagnostic Settings?
Diagnostic Settings enable you to send Azure Virtual Desktop logs and metrics to specified destinations for analysis, troubleshooting, and compliance tracking.
You are configuring a multi-session Windows 10 host pool with custom image requirements. After creating the custom image, which Azure service should you use to store and manage the image for AVD deployment?
Azure Shared Image Gallery is the recommended service for storing, managing, and distributing custom VM images for Azure Virtual Desktop deployments, allowing versioning and replication across regions.
Your organization requires that Azure Virtual Desktop users authenticate using multifactor authentication (MFA). Which Azure service integration is required to enforce this requirement during the initial connection?
Azure AD Conditional Access policies are the primary mechanism for enforcing MFA and other authentication requirements for Azure Virtual Desktop users at the Azure AD authentication layer.
You need to monitor session host CPU utilization and automatically remove unhealthy hosts from the load balancer pool in Azure Virtual Desktop. Which feature should you implement?
Drain mode prevents new sessions from being assigned to a host while allowing existing sessions to complete, and when combined with Azure Automation, can automatically remove unhealthy hosts from service for maintenance or replacement.
When configuring FSLogix profile containers for Azure Virtual Desktop, what is the primary benefit of using Cloud Cache?
FSLogix Cloud Cache maintains a local cache of profile data while synchronizing with remote storage, providing improved performance and offline capability if the cloud storage becomes temporarily unavailable.
You are deploying Azure Virtual Desktop and need to ensure that users can access their session hosts from both internal corporate networks and remote locations securely. Which networking solution provides the most appropriate security boundary while maintaining accessibility?
A site-to-site VPN provides secure access for internal users while conditional access policies enforce security requirements for all users, creating a balanced security and accessibility approach.
When implementing Azure Virtual Desktop for a healthcare organization subject to HIPAA compliance, which storage solution is recommended for storing user profiles and application data?
Azure Files is a HIPAA-eligible service that provides encryption in transit and at rest, along with audit logging capabilities required for healthcare compliance when used with FSLogix profile containers.
Your organization has deployed an Azure Virtual Desktop environment and wants to minimize licensing costs while maintaining performance. Which licensing model should be evaluated for session hosts running Windows Server operating systems?
Azure Hybrid Benefit allows organizations to use existing Server licenses to reduce the cost of session hosts running Windows Server, providing significant cost savings over standard licensing.
You need to configure Azure Virtual Desktop to support session reconnection after temporary network interruptions. Which Windows Remote Desktop Protocol (RDP) setting controls this behavior on the session host?
RDP's automatic session reconnection is controlled through session host Group Policy settings (Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections), allowing users to reconnect to disconnected sessions automatically.
You've reviewed all 61 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free